SY0-701: CompTIA Security+

By CompTIA · Question Mode

QuestionQ41

Security Operations

While conducting digital forensics, which of the following is regarded as the most volatile and whose contents should be collected first?

Explanation

RAM contains live system data that changes continuously and can be lost when power is removed. It is therefore collected before data on persistent media such as hard drives, SSDs, and temporary filesystem files. NIST’s general order of volatility places memory ahead of temporary files and hard-drive data.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!